We just launched the Iconix YouTube Channel. Check out our first video in which we discuss "1% Defenses"  -- how you can help protect your organization against the small number of dangerous emails that evade email defenses. You may notice a new look for SP Guard in the video. More on this exciting new implementation choice later.

A recent blog posting by Cyveillance, the cyber intelligence company, discusses the fake airline ticket scam that you may have been hit with. This is what the email looks like: This is the classic email infiltration attack -- create a message that triggers Vishwanath's response triad: Perceived Relevance Urgency Habit Cyveillance provides an  excellent discussion of the malware delivered in this attack. They also provide this closing observation: The moral of this story is to always beware of unsolicited email and definitely don’t open attachments from unknown sources. The moral of the story discloses the most important tool  in the attacker's arsenal: [...]

The FBI and Secret Service are investigating a cyber attack on the largest bank in the United States, JP Morgan. ABC News reports: What was the "hack" used in this advanced attack?  SANS Institute, the cyber security research and training organization reports: You will not be surprised to learn that this attack, like many such attacks these days, began with a carefully and artfully crafted bait message sent via e-mail. Elaborate security defeated with a deceptive email - spearphishing.  Spearphishing is nothing more than deception perpetrated in email.  It is easy to deceive email recipients. Letting users decide which emails to [...]

Today Iconix released a new whitepaper entitled, "Deploying Deception Sensors in APT Defense." After infiltrating systems, APT actors are hard to find. This lets them do their dirty work for a long time. Mandiant provides this guidance: Detection and remediation are important.  However, prevention is better. In this whitepaper Iconix discusses how targets of APT attacks can deploy sensors that can help detect APT attacks during the attack phase instead of long after the attackers have infiltrated systems. Download the whitepaper here.

Nextgov is reporting on an Inspector General's report regarding the  Nuclear Regulatory Commission (NRC). Nextgov obtained the report under the Freedom of Information Act. The NRC has oversight over nuclear plants in the US, including the inventories of weapons-grade materials.   According to Nextgov, over the last three years the NRC was breached three times by deceptive emails. In one incident, about 215 employees received emails which sought to harvest credentials. About a dozen people followed the malicious link to the credential harvesting site. Whether credentials were stolen or used is unknown, the NRC cleaned their systems in response to this attack. This attack [...]

Israel's advanced missile defense system, Iron Dome, has received substantial press coverage during the recent hostilities between Israel and Hamas. Iron Dome Anti-Missile System Brian Krebs is reporting that security firm Cyber Engineering Services Inc. (CyberESI), has uncovered a massive theft of Iron Dome technical data from three defense contractors involved with the Iron Dome system. How did the bad guys get into the systems to steal this intellectual property? Spearphishing. The attackers used deceptive email as the infiltration phase of an Advanced Persistent Threat ("APT"). As Michael Assante, project lead for Industrial Control System (ICS) and Supervisory Control and Data Acquisition (SCADA) [...]

Kaspersky and Symantec are each reporting on the Turla spy network. Turla  targeted the governments and embassies of a number of former Eastern Bloc countries. Symantec concludes that this espionage has been taking place for at least FOUR YEARS! Unremarkably, the attacks overcame defenses by tricking users into introducing malware into their systems.  From that point, the attackers escalate their rights and conduct espionage.  What tricks did the attackers use to deceive users?  Spearphishing and watering holes.  As Verizon noted in their latest Data Breach Investigations Report, spearphishing has not become less pervasive, the bad guys have merely added watering [...]

eSentire is reporting that a medium sized hedge fund with less than $1 billion under management was  spearphished.  The attackers were able to gain access to the CFO's wire transfer capabilities. Using the wire transfer tools, the attackers made several small transfers to accounts in China, Russia and Turkey aggregating $1.5 million.  How did they pull it off?  The bait was probably an email instructing the victim to check their voicemail messages. This unfortunate theft was triggered by employees who were tricked by deceptive emails. Yet again,  we see that email is an ideal medium for attackers to deceive users into compromising systems.  Every [...]

On July 12, 2014 the Financial Times broke the story of the arrest of Su Bin, a Chinese national living in Canada, for cyberespionage. Bin is accused of computer crimes related to the C-17 transport as well as the F-22 and F-35 fighter planes. As interesting as the press accounts are, they pale in comparison to the  charging document itself.   The affidavit of FBI Special Agent Noel A. Neeman details the methods used by cyberspies to infiltrate targeted organizations and evade detection.  The affidavit provides a rare glimpse into the details of an Advanced Persistent Threat (APT) attack. This is [...]